CISA Adds Single-Factor Authentication to the List of Bad Practices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
on Monday added^[1]
single-factor authentication to the short list of “exceptionally
risky” cybersecurity practices that could expose critical
infrastructure as well as government and the private sector
entities to devastating cyberattacks.

Single-factor authentication is a method^[2]
of signing in users to websites and remote systems by using only
one way of verifying their identity, typically a combination of
username and password. It’s considered to be of low-security, since
it heavily relies on “matching one factor — such as a password — to
a username to gain access to a system.”

But with the use of weak, reused, and common passwords posing a
grave threat, the use of single-factor authentication can lead to
unnecessary risk of compromise and increase the possibility of
account takeover attacks.

With the latest development, the list of bad
practices^[3] now encompasses —

• Use of unsupported (or end-of-life) software
• Use of known/fixed/default passwords and credentials, and
• Use of single-factor authentication for remote or
  administrative access to systems

“Although these Bad Practices should be avoided by all
organizations, they are especially dangerous in organizations that
support Critical Infrastructure or National Critical Functions,”
CISA said.

“The presence of these Bad Practices in organizations that
support Critical Infrastructure or NCFs is exceptionally dangerous
and increases risk to our critical infrastructure, on which we rely
for national security, economic stability, and life, health, and
safety of the public,” the agency noted.

Additionally, CISA is considering adding^[4]
a number of other practices to the catalog, including —

• Using weak cryptographic functions or key sizes
• Flat network topologies
• Mingling of IT and OT networks
• Everyone’s an administrator (lack of least privilege)
• Utilization of previously compromised systems without
  sanitization
• Transmission of sensitive, unencrypted / unauthenticated
  traffic over uncontrolled networks, and
• Poor physical controls